Description

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.

Proof of Concept:

please Note that this leads also to a verbose error that shows credentials of the owner .

**Ex :

Link --> https://v6.thinkadmin.top/admin.html#();

**Response:

{ "id": 10000, "usertype": "normal_code", "username": "admin", "password": "21232f297a57a5a743894a0e4a801fc3", "nickname": "\u7cfb\u7edf\u7ba1\u7406\u5458", "headimg": "https:\/\/v6.thinkadmin.top\/upload\/ec\/f571134493e54fe06855c88557052c.png", "authorize": ",,", "contact_qq": "", "contact_mail": "", "contact_phone": "", "login_ip": "58.219.66.224", "login_at": "2021-09-16 22:09:02", "login_num": 5924, "describe": "", "status": 1, "sort": 2, "is_deleted": 0, "create_at": "2015-11-13 15:14:22", "nodes": [] }

Poc Screen -->https://i.ibb.co/27pxPn0/Screenshot-from-2021-09-16-16-20-49.png

Impact

This vulnerability is capable of... claiming other users cookie performing other advanced scenarios . Account takeover is possible in this case .